CVE-2026-11779CWE-307

PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock access

Medium · published June 26, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
29.1
In the wild
Unconfirmed
What it is

An Improper Authorization vulnerability exists in PayloadCMS version 3.84.1 due to insufficient access control on the account unlock operation.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00364 · 29.1th percentile
Weakness
CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2026-06-26T16:09Z
EPSS history
Timeline
  • 26 JUN 16:09Z
    PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock access
    cvelistv5